Client portal

A client portal is the part of a company’s system that clients sign in to: they check the status of their cases, exchange documents and see only their own data.

Filip Kostecki

Published 21 August 2026

A portal takes the ‘what is happening with my case’ questions and the emailing of documents off your team: clients check the status themselves, at any hour, and files stop travelling as attachments. You also get a record of who opened each client document and when.

How does it work?

Account and sign-in. The client gets an invitation and signs in with a password and a second factor, such as a code from an app on their phone.
Access to their own cases only. Each time a client opens a case or a document, the system checks that it belongs to them. By default nobody sees anything: a client gets access by being assigned to a case, and a member of staff through their role.
Data straight from the firm’s system. The portal uses the same data the team works with: status and deadlines from the case register, documents, billing. It does not copy the data into a separate database that someone would have to update by hand (the single source of truth principle).
Exchange in both directions. Clients download and upload files, write messages and fill in their details. Whenever that happens, the system can notify the person handling the case or send a webhook to another system. An uploaded file goes straight into the firm’s document workflow.
Event log. The system records who opened, downloaded or changed a document, and when. If a client or an auditor asks who had access to it, you check the log.

Example from practice

A portal shows clients the data the team already keeps in order, so we start with the case register. At a service firm we work with, we first merged the cases held in 2 applications, spreadsheets and inboxes into one register with close to 2,000 cases and 1,900 records. Then we added 25 kinds of automatic notification about events in a case. When the status changes or a new document appears in the case, the same mechanism can send the client a message with a link to the portal, with no data retyped into a separate tool. You can read about this project in our case studies.

When does it make sense, and when not?

A portal makes sense when:

clients regularly ask about status, and answering means searching inboxes or asking a colleague;
documents travel by email in both directions, and some of them contain confidential client data;
the client has to supply a full set of documents and needs a weekly reminder of what is still missing.

With a handful of clients and one-off jobs, a portal does not pay off. An account, a password and a second sign-in factor are just a hurdle for the client. Nor should you start with a portal if the team has no single register of cases. The portal would show clients the same mess the team lives with today.

Off-the-shelf software or a bespoke portal?

	Off-the-shelf software (SaaS subscription)	Bespoke portal
Cost	a subscription per user or per bundle of users; check which plan includes the client portal	building it, integrating it with the firm’s systems, maintenance
Fit	the firm adapts its process to the software	the portal is built around the firm’s process and data
Personal data	the provider processes it on the firm’s behalf; check the data processing agreement, the sub-processors and the server location	the firm chooses the hosting; a contractor with access to the data also signs a data processing agreement
Risk	changes to pricing or to what each plan includes	dependence on the contractor, cost of updates

Off-the-shelf software is enough for a typical process. A bespoke portal has the edge when the software cannot connect to the system that holds your data, or when manual workarounds remain even after you have adapted your process to it.

What to watch out for

Access control. A single permissions bug is enough for a client to change a number in the page address and see someone else’s case. Broken access control tops the OWASP Top 10:2025, the list of the most critical web application security risks. Some form of it was found in 100% of the applications tested. Ask your contractor or provider how they test permissions between client accounts.

GDPR. A cloud portal provider, or the company that maintains your server, processes your clients’ data on your behalf. Sign a data processing agreement with them and check where the data is stored. A portal means fewer attachments in email, but it does not replace a risk assessment.

Maintenance. After launch, a portal needs security updates and backups. Someone also has to close the accounts of clients you no longer work with and delete data once the period you have to keep it for is over. Agree with your contractor who does this, and whether the system can delete data automatically after a set time.

This is practical guidance, not legal advice. For a specific case, ask a lawyer.

Ask for a portal quote

Questions and answers

Does a client portal replace email?

The portal takes over document exchange and status questions for the cases you run through it. Email stays for notifications: the client gets a message that a new document is waiting in the portal, and the file itself never leaves as an attachment.

What does the client see in the portal?

Clients see only their own cases: status, deadlines, documents and messages. You decide the exact scope when the portal is set up. The team’s internal notes and draft documents stay in the firm’s system and appear in the portal only when someone shares them.

How much does a client portal cost?

The cost depends on the model. With off-the-shelf software you pay a subscription per user or per bundle of users. With a bespoke portal you pay for the build, the integration with your systems and maintenance. You will find our starting price for a client portal, and what the build includes, on our web systems and portals page. For a quote based on your process, describe it in the form.